en
PRIVACY AND COOKIE POLICY
This Privacy and Cookie Policy sets out the rules for the processing of personal data by INVESTLY prosta spółka akcyjna, hereinafter referred to as the "Controller", as well as the rights of persons whose data is processed.
The Controller attaches particular importance to ensuring a high level of privacy protection and security of the personal data processed. All operations related to data processing are carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the "GDPR".
1. Rules for the processing of personal data
This Policy applies to persons visiting the Administrator's websites, persons contacting the Administrator, as well as persons using (including representing entities using) the services provided by the Administrator.
Providing personal data is, as a rule, voluntary, but in the case of some services provided by the Administrator, it may be a condition for their performance – for example: account registration, order processing, identity verification or responding to a request. Failure to provide certain data may result in the inability to conclude a contract or use certain services.
The Administrator takes the utmost care to ensure that personal data is processed in a fair, transparent and lawful manner, in particular in accordance with the principle of data minimisation. This means that data is collected only to the extent necessary to achieve clearly defined, legitimate purposes and is not stored longer than necessary. Before commencing any processing, the Controller shall identify its purpose and legal basis on a case-by-case basis, ensuring that the data will not be used in a manner inconsistent with those purposes.
The Controller exercises the rights of data subjects in accordance with the applicable provisions of the GDPR. All requests and notifications related to data processing are considered without undue delay, with respect for the principles of transparency and fairness towards the notifying party.
In order to ensure the integrity, confidentiality and availability of the data being processed, the Controller has implemented appropriate technical and organisational measures to protect personal data against accidental destruction, loss, modification, unauthorised disclosure or access. Access to the data is restricted to duly authorised persons who are bound by confidentiality obligations and trained in information security principles.
The Administrator does not process personal data in a manner that leads to automated decision-making that could have legal effects on a person or otherwise significantly affect them, including through profiling, without obtaining separate consent or meeting other requirements under the law. If such solutions are implemented, transparency of operation and the possibility of human intervention in the decision-making process will be ensured in each case.
2. Sources of personal data
The controller obtains personal data directly from the data subjects, in particular when registering a user account on the controller's website, using the services available on the website, submitting contact enquiries, communicating with customer service, and participating in identity verification processes.
Personal data may come from other sources, in particular from a representative, a principal in the case of a power of attorney, data providers, employers, including parties to contracts concluded with the Administrator.
3. Basis for the processing of personal data
The Controller may process personal data for the following purposes:
1) performance of activities related to the conclusion and performance of a contract, in particular:
- providing services within the scope of the concluded contract;
- taking actions related to user registration/login;
- contacting the user in matters related to the service provided;
- taking action prior to the conclusion of a contract, in particular providing an offer at the request of the data subject.
Legal basis: Article 6(1)(b) of the GDPR.
Data retention period: the duration of the contract.
2) establishing business relations, including responding to questions asked in connection with contact from data subjects, as part of the Controller's legitimate interests in responding to enquiries.
Legal basis: Article 6(1)(f) of the GDPR.
Data retention period: until an effective objection to data processing is raised, but no longer than until the last day of the calendar year following the expiry of 3 years from the date of the Controller's response.
3) fulfilment of tax and accounting obligations in connection with the relevant tax and accounting regulations.
Legal basis: tax and accounting regulations, Article 6(1)(c) of the GDPR.
Data retention period: duration of the legal obligation.
4) fulfilment of verification obligations in connection with the relevant anti-money laundering and counter-terrorist financing regulations.
Legal basis: anti-money laundering and counter-terrorist financing regulations, Article 6(1)(c) of the GDPR.
Data retention period: duration of the legal obligation.
5) improving the functioning of our own services in connection with the pursuit of the Controller's legitimate interests consisting in looking after the Controller's interests, customer satisfaction and the quality of services provided.
Legal basis: Article 6(1)(f) of the GDPR.
Data retention period: duration of the contract.
6) pursuing or securing possible claims and handling complaints, as part of the Administrator's legitimate interests in protecting the rights of the Administrator and the persons whose rights are affected.
Legal basis: Article 6(1)(f) of the GDPR.
Data retention period: limitation period for the claim in question.
7) marketing of own services in connection with the pursuit of the Controller's legitimate interests consisting in looking after the Controller's interests and promoting services.
Legal basis: Article 6(1)(f) of the GDPR.
Data retention period: until consent to receive communications or information is withdrawn on the basis of the provisions of the Act on the provision of electronic services and electronic communications law) or until an effective objection to data processing is lodged.
4. Recipients of personal data
Personal data may be transferred to entities authorised to receive it under applicable law, including competent state authorities, in particular judicial authorities.
Personal data may also be transferred to trusted recipients such as: payment operators, partners providing technical services (development and maintenance of IT systems and websites), identity verification service providers, entities whose products are offered for sale on the controller's websites, entities providing accounting and bookkeeping services.
The controller ensures that these entities process data in accordance with applicable regulations, and if data processing is carried out on behalf of the controller, appropriate personal data processing agreements are concluded.
5. Transfer of data outside the European Economic Area (EEA)
Personal data may be transferred outside the EEA in cases where it is necessary to complete a transaction for the purchase of a specific product by a customer, and the product purchased through the Administrator's software is offered by an entity based outside the EEA. For the avoidance of doubt, the Administrator shall identify products from suppliers outside the EEA.
If data is transferred outside the EEA, personal data will be transferred to recipients in third countries (outside the EEA) on the basis of an adequacy decision by the European Commission or on the basis of standard contractual clauses in accordance with a decision of the European Commission or on the basis of the explicit consent of the data subject.
When a user purchases a product offered by an entity based outside the EEA, personal data is transferred outside the EEA on a one-off basis for the purpose of completing a specific transaction. The transfer is necessary for the performance of the contract between the Administrator and the user making the transaction and the contract for the transaction between the user and the entity offering the specific product.
6. Rights of data subjects
Data subjects have the following rights:
- access to data and obtain copies thereof;
- to rectify the data;
- request the erasure of data;
- restriction of the processing of personal data;
- to transfer the data;
- object to the processing of data on the basis of the legitimate interest of the Controller or to processing for direct marketing purposes;
- withdrawal of consent, if processing is based on consent, which shall not affect the lawfulness of prior processing of personal data;
- lodge a complaint with a supervisory authority.
In order to exercise the above rights, you may contact the Controller in the manner indicated in point VII.
7. Contact details
The personal data controller is INVESTLY prosta spółka akcyjna (Aleja Jana Pawła II 27/38a, 02-815 Warsaw).
In matters relating to personal data protection, you can contact the Controller:
- by post to the address of the Controller's registered office indicated in the preceding sentence;
- by email at: privacy@investly.pro
8. Cookies and similar tracking technologies
The Administrator uses cookies or other similar technologies (hereinafter collectively referred to as "cookies") on its websites. Cookies are small text files stored on the user's device, which, among other things, facilitate the use of the website.
When using cookies, the Administrator may process data about the user's device, its location, activities performed on the website (e.g. time of visit) and other data, depending on the cookie used (e.g. interest in a selected advertisement). Cookies are not, in principle, personal data, but when combined with other information, they may, to a certain extent, constitute personal data.
9. Types of cookies used
The administrator uses "session" and "persistent" cookies, depending on their storage time. Session cookies are stored until the end of the session, i.e. until the browser is closed or the user logs out, while persistent cookies are stored depending on their parameters and can be deleted manually by the user.
The Administrator uses cookies – depending on the owner – its own and third-party cookies. First-party cookies are sent directly by the website, and third-party cookies are created by external entities.
Due to the various purposes for which cookies are used, the Administrator may use different types of cookies on its websites. Depending on the purpose of their use, the Administrator may use the following types of cookies in particular:
- necessary cookies, i.e. cookies that must be stored and read on the user's end device for the website to function properly. These include, among others, functions related to logging into the user's account, ensuring security (e.g. protection against unauthorised access), and managing basic communication with the server. Without them, some elements of the website may not function properly or may not be available at all;
- functional cookies, i.e. cookies that enable the website to remember the choices made on the website, for example: the preferred language of the website, the layout of the content and the region in which the user is located;
- analytical/statistical cookies, i.e. cookies that allow the website owner to monitor user traffic and verify the choices made, including information about how the website is used in order to analyse traffic and improve its performance, based on Google Analytics. These cookies allow for a better understanding of visitor behaviour (e.g. most frequently visited subpages, technical errors) and enable the creation of anonymous statistics that help in developing and improving the website.
Detailed information about the cookies used, as well as a list of third-party providers whose tools may cause a cookie to be stored on the user's device, is available in the cookie consent management area, which appears during the first visit to the website and remains available in its footer. You can view the details and change your consent settings at any time.
10. Cookie management
All cookies indicated, except for those that are necessary, require the user's consent before they can be used. The user makes a choice regarding the cookies used (except for those that are necessary), and until explicit consent is given, accepted and selected via a button, cookies are blocked by default. At any time, the user may change the cookie settings on the Administrator's website by withdrawing consent or objecting to cookies that are not necessary.
Cookie settings can also be changed directly in the web browser used by the User. The User can manage cookies at the browser level by setting each time information about placing a cookie on the device or blocking their automatic saving. Depending on the browser, the configuration can be made in accordance with the information provided below:
Instructions for Microsoft Edge
Instructions for Google Chrome
Instructions for Mozilla Firefox
The administrator reserves that disabling or limiting the use of technically necessary cookies may affect the proper functioning of certain elements of the website, limiting the availability of functions or the comfort of using the website.
11. Changes to the Privacy Policy
The administrator reserves the right to update the Privacy Policy and cookie policy. The current version will always be available on the administrator's website.